Advisories · Technology

Microsoft Exchange Server 2019 Cumulative Update 4.

Every CVE that names Microsoft Exchange Server 2019 Cumulative Update 4 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-26858 CVE record

CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

Microsoft Exchange Server Remote Code Execution Vulnerability
- Microsoft Exchange Server 2013 Cumulative Update 21
- Microsoft Exchange Server 2013 Cumulative Update 22
Not analysed yet 2 Mar 2021
CVE-2021-26855 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Microsoft Exchange Server Remote Code Execution Vulnerability
- Microsoft Exchange Server 2013 Cumulative Update 21
- Microsoft Exchange Server 2013 Cumulative Update 22
- Server-side request forgery (SSRF)
Not analysed yet 2 Mar 2021
CVE-2020-0903 CVE record

CVSS 5.4 Medium

Cross-site scripting in Microsoft Exchange Server 2019 Cumulative Update 4 and others
- Microsoft Exchange Server 2019 Cumulative Update 4
- Microsoft Exchange Server 2016 Cumulative Update 15
- Cross-site scripting (XSS)
Not analysed yet 12 Mar 2020
CVE-2020-0692 CVE record

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
- Microsoft Exchange Server 2013
- Microsoft Exchange Server 2019 Cumulative Update 3
Not analysed yet 11 Feb 2020
CVE-2020-0688 CVE record

CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

Improper authentication in Microsoft Exchange Server 2013 and others
- Microsoft Exchange Server 2013
- Microsoft Exchange Server 2019 Cumulative Update 3
- Authentication bypass
Not analysed yet 11 Feb 2020